Privacy Policy

Who we are

SuriAgenda is published by BlueOceanSolutions B.V. (Dutch Chamber of Commerce / KVK no. 92101550), registered at Duintopstraat 11, 1361 BJ Almere, the Netherlands ('BlueOceanSolutions', 'we', 'us', or 'SuriAgenda'). We are the data controller for the personal data described in this policy.

Questions about this policy, about the data we hold on you, or want to exercise one of your rights? Contact us at info@suriagenda.com.

Scope of this policy

This policy applies to suriagenda.com and every feature there: browsing the event agenda, creating an attendee account, RSVPing to or ordering tickets for an event, registering and managing events as an organizer, and subscribing to organizer Premium or a Single Event Promotion.

It does not cover the organizer's own handling of your data once a ticket payment is settled directly with them (see 'Event, RSVP, and order data' below) — that is governed by the organizer's own privacy practices, not this policy.

Account and authentication data

When you create an attendee or organizer account, you sign in either through Microsoft Entra External ID (including federated Google/Facebook/Apple sign-in routed through Entra) or with a native email and password. Depending on the method, we receive your name, email address, and a unique account identifier ('sub' claim). Organizer accounts additionally store the business or event details you provide during registration (organization name, contact details, event listings).

Your account is assigned a role — attendee ('member'), organizer ('vendor'), or, for a small number of BlueOceanSolutions staff, 'admin' — used to control which parts of SuriAgenda you can access. Legal basis: performance of a contract (providing you an account) and, for admin access, our legitimate interest in operating the platform securely.

Event, RSVP, and order data

When you RSVP to an event or place a ticket order, we store the event, the quantity and ticket type, your attendee identity, and the order status (confirmed, cancelled, or — rarely — flagged for admin review as disputed). We use this to manage capacity, show you your tickets, and let organizers see who is attending their event.

Important: ticket payment for SuriAgenda events is settled directly and off-platform between you and the event organizer. SuriAgenda does not process, collect, or store your payment card details, bank details, or any other payment data for ticket purchases — we simply record that an order exists. Any billing or payment dispute regarding a ticket is a matter between you and the organizer; see our Terms of Service for details.

Payments via Stripe (subscription and promotion only)

Unlike ticket purchases, two specific organizer purchases — the Premium subscription and the Single Event Promotion — are billed through Stripe, our payment processor. When an organizer subscribes to Premium or buys a Single Event Promotion, they are redirected to a Stripe-hosted Checkout page or Stripe Customer Portal; SuriAgenda never receives or stores full card numbers. Stripe processes the organizer's billing name, email, and payment details as an independent data controller/processor under its own privacy policy (https://stripe.com/privacy), and calculates applicable VAT via Stripe Tax.

We store only the resulting subscription or purchase status (e.g. active, trialing, cancelled; or purchased/featured) needed to grant the corresponding feature (Featured placement, unlimited event listings, analytics).

First-party analytics (organizer funnel tracking)

SuriAgenda records aggregate, first-party interaction data for organizers' own events — page views, ticket-link clicks, and RSVP clicks — so organizers can see a basic performance funnel for their events in their dashboard. This is not shared with any third-party analytics vendor and is not used for advertising. Where available, it also records the marketing channel (for example, a link shared on social media) that brought a visitor to an event page.

Google Analytics 4

SuriAgenda uses Google Analytics 4 to help us understand overall site usage. This integration only fires an event after you have explicitly granted analytics consent through the cookie banner; that choice is stored in your browser. If you give no answer, or refuse, no Google Analytics event is sent at all.

This follows Google Consent Mode v2's default-denied approach, set on every page before the Google container loads — the same approach used elsewhere in the Suri* platform. On top of that, our own code re-checks your consent on every event, so nothing is sent even if a tag inside the container were misconfigured.

reCAPTCHA

We use Google reCAPTCHA v3 (invisible, score-based) on the ticket order form to prevent automated abuse (bots, spam orders). reCAPTCHA analyses interaction data and sends it to Google, subject to Google's privacy policy (https://policies.google.com/privacy). Legal basis: our legitimate interest in protecting the ticketing system from abuse.

Cookies

SuriAgenda uses a strictly necessary session cookie to keep you signed in. That needs no consent and cannot be switched off without signing out.

If you grant analytics consent (see 'Google Analytics 4' above), your choice is stored in your browser so we remember it, and Google Analytics sets its own cookies. You can change or withdraw that choice at any time via 'Cookie preferences' at the bottom of every page — as easy as giving it, as Art. 7(3) GDPR requires. We do not use advertising cookies or third-party tracking cookies.

Your rights (GDPR)

Under the GDPR, you have the right to access, rectify, or erase your data, restrict or object to processing, request data portability, and withdraw consent at any time.

If you are signed in, most of this is self-service at /mijn-profiel/privacy: you can download a full export of your personal data as a ZIP file, request erasure of your account, and revoke marketing consent (effective within 24 hours). Requesting erasure starts a 30-day grace period during which you can change your mind by contacting us; after that period, your account data is deleted, except that ticket order and financial records are anonymized (stripped of your name and contact details) and retained for 7 years, as Dutch tax and accounting law requires — they are never restored to an identifiable state.

For anything not covered by that self-service flow, or if you cannot sign in, email info@suriagenda.com; we respond within the statutory one-month period. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Retention periods

We do not keep personal data longer than necessary for the purpose it was collected for: account data for as long as your account is active (see 'Your rights' above for erasure), event/RSVP/order data for as long as needed to manage the event plus the statutory retention noted above for financial records, and organizer subscription/promotion status for as long as the subscription or promotion is active plus a reasonable administrative period.

International data transfers

Some of the parties above (Microsoft, for Entra External ID authentication and Azure hosting; Google, for reCAPTCHA and Analytics; Stripe, for subscription and promotion billing) may process data on servers outside the European Economic Area. In those cases, we and our partners rely on appropriate safeguards, such as the EU Standard Contractual Clauses or another transfer mechanism recognized by the European Commission.

Server logs and security

Like almost every website, our hosting and security systems keep technical logs (such as IP address, timestamp, and requested URL) to detect and prevent abuse, outages, and security incidents. These logs are not used for profiling and are automatically deleted after a maximum of 90 days, unless a longer period is necessary for an ongoing security investigation.

Children

SuriAgenda is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe we have inadvertently collected data from a minor, contact info@suriagenda.com so we can remove it.

Changes to this policy

We may update this policy from time to time, for example when we add new functionality or when laws change. The date at the top of this page shows when it was last updated. For material changes, we will notify active organizer accounts by email.

Contact

BlueOceanSolutions B.V. (KVK 92101550), Duintopstraat 11, 1361 BJ Almere, the Netherlands. Email: info@suriagenda.com.